<![CDATA[🟠 High: Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets]]>Threat actors are actively exploiting a now-patched vulnerability in Zimbra Collaboration Suite (ZCS) to plant web shells and steal mailbox data, according to research from the Microsoft Security Research team. The flaw, tracked as CVE-2026-73570, carries a CVSS score of 8.9 and is described as an unauthenticated operating system command injection issue that can lead to remote code execution.

The attack chain begins with the unauthenticated command injection, which allows adversaries to run arbitrary commands on exposed Zimbra instances. Once inside, attackers deploy web shells to maintain persistent access and go after authentication secrets and mailbox content.

Key details to note:

  • Affected platform: Zimbra Collaboration Suite (ZCS)
  • Vulnerability type: unauthenticated OS command injection leading to remote code execution
  • Identifier: CVE-2026-73570
  • Severity: CVSS 8.9
  • Status: patch is available; the flaw is now patched
  • Observed post-exploitation activity: web shell deployment and mailbox data access

If your organization runs Zimbra, confirm you are on a patched build and review your mail infrastructure for signs of unauthorized access, including unexpected web shells and suspicious authentication activity. Because the flaw is unauthenticated, any internet-facing ZCS instance that has not been updated should be treated as potentially exposed.

Source: The Hacker News

Has your organization already applied the Zimbra patch, and what steps are you taking to check for web shells or compromised credentials?

]]>https://xploitlk.com/topic/525/high-attackers-exploit-zimbra-flaw-to-deploy-web-shells-and-harvest-authentication-secretsRSS for NodeTue, 27 Oct 2026 10:13:12 GMTThu, 01 Oct 2026 04:30:29 GMT60